From d52abcbcbdfcd29b0d29ce2bbe39a3bdef26cdaf Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 25 Feb 2021 09:58:07 -0500 Subject: [PATCH 1/4] ensure zeekctl is run as user zeek https://github.com/Security-Onion-Solutions/securityonion/issues/3130 --- salt/common/tools/sbin/so-zeek-stats | 4 ++-- salt/zeek/cron/packetloss.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-zeek-stats b/salt/common/tools/sbin/so-zeek-stats index ff89c6506..9ebef1217 100755 --- a/salt/common/tools/sbin/so-zeek-stats +++ b/salt/common/tools/sbin/so-zeek-stats @@ -24,11 +24,11 @@ show_stats() { echo echo "Average throughput:" echo - docker exec -it so-zeek /opt/zeek/bin/zeekctl capstats + docker exec -it so-zeek "runuser -l zeek '/opt/zeek/bin/zeekctl capstats'" echo echo "Average packet loss:" echo - docker exec -it so-zeek /opt/zeek/bin/zeekctl netstats + docker exec -it so-zeek "runuser -l zeek '/opt/zeek/bin/zeekctl netstats'" echo } diff --git a/salt/zeek/cron/packetloss.sh b/salt/zeek/cron/packetloss.sh index c8750dd92..a083895d7 100755 --- a/salt/zeek/cron/packetloss.sh +++ b/salt/zeek/cron/packetloss.sh @@ -1,2 +1,2 @@ #!/bin/bash -/usr/bin/docker exec so-zeek /opt/zeek/bin/zeekctl netstats | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 +/usr/bin/docker exec so-zeek "runuser -l zeek '/opt/zeek/bin/zeekctl netstats'" | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 From add66e750ec95980bafca9bea078b97f82c8a378 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 25 Feb 2021 10:49:09 -0500 Subject: [PATCH 2/4] forgot to add -c --- salt/common/tools/sbin/so-zeek-stats | 4 ++-- salt/zeek/cron/packetloss.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-zeek-stats b/salt/common/tools/sbin/so-zeek-stats index 9ebef1217..e5eb90b61 100755 --- a/salt/common/tools/sbin/so-zeek-stats +++ b/salt/common/tools/sbin/so-zeek-stats @@ -24,11 +24,11 @@ show_stats() { echo echo "Average throughput:" echo - docker exec -it so-zeek "runuser -l zeek '/opt/zeek/bin/zeekctl capstats'" + docker exec -it so-zeek "runuser -l zeek -c '/opt/zeek/bin/zeekctl capstats'" echo echo "Average packet loss:" echo - docker exec -it so-zeek "runuser -l zeek '/opt/zeek/bin/zeekctl netstats'" + docker exec -it so-zeek "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" echo } diff --git a/salt/zeek/cron/packetloss.sh b/salt/zeek/cron/packetloss.sh index a083895d7..581246971 100755 --- a/salt/zeek/cron/packetloss.sh +++ b/salt/zeek/cron/packetloss.sh @@ -1,2 +1,2 @@ #!/bin/bash -/usr/bin/docker exec so-zeek "runuser -l zeek '/opt/zeek/bin/zeekctl netstats'" | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 +/usr/bin/docker exec so-zeek "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 From c8213fa3d4a2f5c42da1fc1b677514664026b094 Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 25 Feb 2021 11:07:54 -0500 Subject: [PATCH 3/4] change docker exec --- salt/common/tools/sbin/so-zeek-stats | 4 ++-- salt/zeek/cron/packetloss.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-zeek-stats b/salt/common/tools/sbin/so-zeek-stats index e5eb90b61..1fdffda48 100755 --- a/salt/common/tools/sbin/so-zeek-stats +++ b/salt/common/tools/sbin/so-zeek-stats @@ -24,11 +24,11 @@ show_stats() { echo echo "Average throughput:" echo - docker exec -it so-zeek "runuser -l zeek -c '/opt/zeek/bin/zeekctl capstats'" + docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin "runuser -l zeek -c '/opt/zeek/bin/zeekctl capstats'" echo echo "Average packet loss:" echo - docker exec -it so-zeek "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" + docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" echo } diff --git a/salt/zeek/cron/packetloss.sh b/salt/zeek/cron/packetloss.sh index 581246971..5991c4d23 100755 --- a/salt/zeek/cron/packetloss.sh +++ b/salt/zeek/cron/packetloss.sh @@ -1,2 +1,2 @@ #!/bin/bash -/usr/bin/docker exec so-zeek "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 +/usr/bin/docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 From fcd3f81400b93b87dedf0f6bf3955ef5300f052e Mon Sep 17 00:00:00 2001 From: m0duspwnens Date: Thu, 25 Feb 2021 11:16:53 -0500 Subject: [PATCH 4/4] fix quotes --- salt/common/tools/sbin/so-zeek-stats | 4 ++-- salt/zeek/cron/packetloss.sh | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/salt/common/tools/sbin/so-zeek-stats b/salt/common/tools/sbin/so-zeek-stats index 1fdffda48..d3e9b40a6 100755 --- a/salt/common/tools/sbin/so-zeek-stats +++ b/salt/common/tools/sbin/so-zeek-stats @@ -24,11 +24,11 @@ show_stats() { echo echo "Average throughput:" echo - docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin "runuser -l zeek -c '/opt/zeek/bin/zeekctl capstats'" + docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin runuser -l zeek -c '/opt/zeek/bin/zeekctl capstats' echo echo "Average packet loss:" echo - docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" + docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats' echo } diff --git a/salt/zeek/cron/packetloss.sh b/salt/zeek/cron/packetloss.sh index 5991c4d23..0a3df7a18 100755 --- a/salt/zeek/cron/packetloss.sh +++ b/salt/zeek/cron/packetloss.sh @@ -1,2 +1,2 @@ #!/bin/bash -/usr/bin/docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin "runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats'" | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1 +/usr/bin/docker exec so-zeek env -i PATH=/bin:/usr/bin:/sbin:/usr/sbin:/opt/bin:/usr/local/bin:/usr/local/sbin runuser -l zeek -c '/opt/zeek/bin/zeekctl netstats' | awk '{print $(NF-2),$(NF-1),$NF}' | awk -F '[ =]' '{RCVD += $2;DRP += $4;TTL += $6} END { print "rcvd: " RCVD, "dropped: " DRP, "total: " TTL}' >> /nsm/zeek/logs/packetloss.log 2>&1